Falhas do tipo CWE-80

586 resultados

Falta de neutralização de tags HTML relacionadas a scripts (XSS básico)

Ocorre quando a aplicação web recebe entrada do usuário e a exibe no HTML sem sanitizar tags de script e eventos (como <script>, onclick, onerror). Um atacante injeta código JavaScript malicioso que executa no navegador da vítima, roubando cookies, sessões ou dados sensíveis.

Exemplo

Um formulário de comentários aceita '<img src=x onerror="alert(document.cookie)">'. A aplicação exibe o comentário sem filtro na página, e o navegador executa o código malicioso quando carrega a imagem inválida, capturando a sessão do usuário.

Como mitigar

Escape ou remova todas as tags HTML perigosas antes de renderizar (use bibliotecas como DOMPurify ou sanitizadores nativos da stack). Aplique Content Security Policy (CSP) nos headers HTTP para bloquear inline scripts mesmo que a injeção passe.

CVE-2025-54421HIGHNamelessMC allows Stored Cross Site Scripting (XSS) in SEO componentEPSS 0.4%CVE-2023-28851MEDIUMSilverstripe Form Capture vulnerable to Stored Cross-Site ScriptingEPSS 0.4%CVE-2026-1154MEDIUMSourceCodester E-Learning System Lesson index.php cross site scriptingEPSS 0.4%CVE-2024-6052MEDIUMXSS in SQL check parametersEPSS 0.4%CVE-2024-54001MEDIUMKanboard allows a persistent HTML injection site scripting in settings page date formatEPSS 0.4%CVE-2025-53093HIGHTabberNeue vulnerable to Stored XSS through wikitextEPSS 0.4%CVE-2024-11479MEDIUMAuthenticated HTML Injection in Issuetrak Ticket Comment FunctionEPSS 0.4%CVE-2024-47765MEDIUMMinecraft MOTD Parser's HtmlGenerator vulnerable to XSSEPSS 0.4%CVE-2024-20382MEDIUMA vulnerability in the VPN web client services feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefensEPSS 0.4%CVE-2025-54117CRITICALNamelessMC allows Stored Cross-Site Scripting (XSS) in dashboard text editorEPSS 0.4%CVE-2024-23841HIGHXSS in @apollo/experimental-nextjs-app-supportEPSS 0.4%CVE-2024-24812MEDIUMFrappe Authenticated Reflected Cross site scripting (XSS) in portal pagesEPSS 0.4%CVE-2023-30615MEDIUMImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-webEPSS 0.4%CVE-2025-47600MEDIUMWordPress WoodMart theme <= 8.3.7 - Arbitrary Shortcode Execution vulnerabilityEPSS 0.4%CVE-2023-1384MEDIUMThe setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to bEPSS 0.4%CVE-2024-5851MEDIUMplaySMS SMS Schedule cross site scriptingEPSS 0.4%CVE-2024-52597MEDIUM2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access renderEPSS 0.4%CVE-2024-4214LOWWordPress cardealer plugin <= 4.15 - Content Injection vulnerabilityEPSS 0.4%CVE-2023-48763MEDIUMWordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerabilityEPSS 0.4%CVE-2024-6251MEDIUMplaySMS New Phonebook cross site scriptingEPSS 0.4%